What the developer wrote
Authored by Craig Raw
add bitbox02 attestation failed dialog
What changed, and why it matters
This commit adds a user-facing warning dialog when a BitBox02 hardware wallet fails an attestation check. Attestation is a process that helps verify the device is genuine and not a counterfeit or tampered unit. Previously, a failed attestation may not have been clearly communicated to the user. The change improves security by warning users not to store funds on a device that failed verification until they confirm it externally. It is a defensive hardening change, not an active vulnerability fix.
No immediate action required. This is a beneficial defensive change. Users should ensure they are running a Sparrow version that includes this dialog and should heed the warning if it appears. Developers may consider similar attestation warnings for other hardware wallet integrations if not already present.
Security signals we found
Adds explicit user warning for failed hardware wallet attestation
Prevents repeated warning dialogs during device enumeration using AtomicBoolean
Warns user not to store funds on potentially counterfeit device
Improves transparency of hardware security state to the user
Evidence from the diff
In Hwi.java, the BitBoxFxNoiseConfig inner class now overrides attestationCheck(boolean result). If result is false, it logs a warning and uses an AtomicBoolean to ensure only one modal warning dialog is shown per session (because devices are opened repeatedly during enumeration). The dialog is shown on the JavaFX application thread via Platform.runLater(), using AppServices.showWarningDialog() with a title and message explaining the BitBox02 may not be genuine and advising against storing funds until external verification.
Changed components
src/main/java/com/sparrowwallet/sparrow/io/Hwi.javaBitBox02 hardware wallet integrationBitBoxFxNoiseConfig classInspect captured patch +16 / −1
diff --git a/src/main/java/com/sparrowwallet/sparrow/io/Hwi.java b/src/main/java/com/sparrowwallet/sparrow/io/Hwi.java
index fd9fa8d..9c3165b 100644
--- a/src/main/java/com/sparrowwallet/sparrow/io/Hwi.java
+++ b/src/main/java/com/sparrowwallet/sparrow/io/Hwi.java
@@ -541,12 +541,27 @@ public class Hwi {
}
private static final class BitBoxFxNoiseConfig extends BitBoxFileNoiseConfig {
+ private static final AtomicBoolean attestationWarningShown = new AtomicBoolean(false);
+
private BitBoxPairingDialog pairingDialog;
public BitBoxFxNoiseConfig() {
super(Path.of(Storage.getDataHome().getAbsolutePath(), LARK_HOME_DIR, BITBOX_FILENAME).toFile());
}
+ @Override
+ public void attestationCheck(boolean result) {
+ if(!result) {
+ log.warn("BitBox02 attestation check failed, device may not be genuine");
+ //Devices are opened repeatedly while enumerating, so warn only once per session
+ if(attestationWarningShown.compareAndSet(false, true)) {
+ Platform.runLater(() -> AppServices.showWarningDialog("BitBox02 Attestation Failed",
+ "This BitBox02 did not pass the attestation check, which means it may not be a genuine device.\n\n" +
+ "Do not use it to store funds until you have verified it externally."));
+ }
+ }
+ }
+
@Override
public boolean showPairing(String code, DeviceResponse response) throws DeviceException {
CountDownLatch latch = new CountDownLatch(1);
Why this scored 25/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.